Provider Readiness SeriesEpisode 2Free live session
Your Participant Files Are a Target: Cyber Security for NDIS Providers
Health service providers made more data breach notifications than any other sector in Australia from January to June 2026. In 45 minutes, Faraz Khan and Naseer Sahi cover where provider data gets exposed, what the privacy rules expect of you, and what to do when participant data is compromised.
DateThursday 5 November 2026
Time3:00 PM AEDT (Sydney, Melbourne)
Format45-minute podcast-style conversation
WhereLive on StreamYard. Link sent by email.
00Days
00Hours
00Mins
00Secs
NS
With Faraz Khan, Founder, Supportly (Vertex 360), and Naseer Sahi, [GUEST_TITLE], [GUEST_ORGANISATION]
Save your seat
Free. Takes 60 seconds. Your viewing link arrives by email.
We use your details to send your viewing link and session reminders. Privacy policy
149
Data breach notifications from health service providers, the top sector
OAIC, January to June 2026
95%
Of health sector incidents the ACSC responded to, attackers succeeded
ASD Cyber Threat Report 2024 to 25
$56,600
Average cost of cybercrime to a small business ($97,200 for medium)
ASD Cyber Threat Report 2024 to 25
214%
Rise in NDIS Commission compliance and enforcement outcomes
NDIS Commission Annual Report 2024 to 25
Why participant files
One file holds everything an attacker wants
Identity details, health information, funding and plan details, contact details for family and support networks. A participant file puts it all in one place, and most providers hold hundreds of them across shared inboxes, staff phones and cloud folders.
Attackers know it. Most breaches start with something ordinary: a staff member clicks a link, a shared password gets reused, an invoice request looks real enough to pay.
Privacy is one of the eight elements of the NDIS Code of Conduct, and it applies whether you are registered or not. When participant data is exposed, "we're too small to be a target" is not a defence.
Ask yourself before Thursday 5 November
Who in your team can open every participant file, and do they all need to?
Would you know within a day if a staff email account was taken over?
Does your consent process cover CCTV, monitoring and photos?
If a laptop went missing tomorrow, who decides whether it gets reported?
What we'll cover
Three risks, 45 minutes, practical answers
Each segment pairs Naseer's specialist view with a real Australian case, so you leave knowing what to check in your own organisation.
Pillar 1
Breach exposure
Phishing, business email compromise and ransomware targeting participant data.
What a real attack on a provider looks like, step by step
The gaps seen most often: staff, devices, passwords, shared inboxes
What happens to operations on the day ransomware hits
Pillar 2
Privacy obligations
The NDIS Code of Conduct privacy element, consent and surveillance.
What the privacy element asks of registered and unregistered providers
What consent needs to cover, and when to ask again
Where CCTV and monitoring cross the line, with a recent NDIS Commission case
Pillar 3
Breach response
Assessing, containing and notifying when participant data is compromised.
The first hours: who does what, in what order
How to assess whether a breach needs to be reported
Telling participants and families without making it worse
Built for the people who hold the keys to participant data
Registered NDIS providers
You're already audited on governance. This covers the cyber and privacy gaps an auditor or the NDIS Commission will ask about next.
Unregistered providers
Supporting self-managed participants? The Code of Conduct privacy element still applies to you. Here's what that means day to day.
Large multi-site providers
More sites means more devices, more inboxes and more people with access. Learn where risk concentrates and how to contain it.
Most useful for:
Operations managersService delivery leadsCompliance officersDirectors and owners
Your host and guest
A specialist conversation, not a sales pitch
Host
Faraz Khan
Founder, Supportly (Vertex 360)
Faraz built Supportly (Vertex 360) to help NDIS providers turn compliance obligations into a straightforward operating system instead of a source of dread. He hosts the Provider Readiness Series and puts a selection of your registration questions to each guest, including Naseer on cyber security and privacy.
NS
Guest
Naseer Sahi
[GUEST_TITLE], [GUEST_ORGANISATION]
[GUEST_BIO_50_80_WORDS: approved by Naseer. Cover his cyber or privacy specialism, years of experience and the sectors he has worked with.]
[GUEST_CREDENTIALS: e.g. certifications or memberships] · LinkedIn
Your question, answered on air
Send Naseer your question when you register
There's no live chat. Questions come in through the registration form, and Faraz puts a selection to Naseer during the audience segment. The more specific, the more useful the answer.
What NDIS providers say about Supportly (Vertex 360)
"Vertex 360 has been a great app for our team. The system is easy to use and supports our daily workload well. It keeps our information organised and helps us manage participants, rosters, and compliance in a clear and efficient way. The ongoing updates show commitment to improving the platform and supporting providers."
Alpha Pattison, customer review
"Vertex360 has really been great in simplifying our operations..from staff and client onboarding, to ensuring that we remain compliant."
Devis Inyama, customer review
"We’ve been using Vertex360 and it’s been a great experience, easy to use with a very helpful and responsive support team. Highly recommend it for anyone managing NDIS services."
Arpit, customer review
Before you register
Common questions
Is it free?
Yes. The Provider Readiness Series is free for NDIS providers and their teams.
How do I watch?
The session streams live on StreamYard. Your viewing link comes in your confirmation email, with reminders before the start time.
Will there be a recording?
[CONFIRM_REPLAY: e.g. "Yes. Everyone who registers receives the replay link after the session." Remove this question if there is no replay.]
We're not registered with the NDIS Commission. Is this relevant to us?
Yes. Privacy is one of the eight elements of the NDIS Code of Conduct, and the Code applies to registered and unregistered providers.
Do I need to have watched Episode 1?
No. Episode 1 covered keeping participant records for seven years under the new NDIS laws. Episode 2 covers keeping those records safe. Each episode stands on its own.
Is this a product demo?
No. It's a conversation with an independent specialist. Faraz will point to where Supportly (Vertex 360) helps at the close, and you can skip that part if it's not for you.
Can I bring my team?
Yes. Each person registers with their own email so they get their own viewing link and can submit their own question.
.png)
